Taha, Ahmed ; Metzler, Patrick ; Trapero, Ruben ; Luna, Jesus ; Suri, Neeraj (2016)
Identifying and Utilizing Dependencies Across Cloud Security Services.
Xi'an, China
doi: 10.1145/2897845.2897911
Konferenzveröffentlichung, Bibliographie
Kurzbeschreibung (Abstract)
Security concerns are often mentioned amongst the reasons why organizations hesitate to adopt Cloud computing. Given that multiple Cloud Service Providers (CSPs) offer similar security services (e.g., "encryption key management") albeit with different capabilities and prices, the customers need to comparatively assess the offered security services in order to select the best CSP matching their security requirements. However, the presence of both explicit and implicit dependencies across security related services add further challenges for Cloud customers to (i) specify their security requirements taking service dependencies into consideration and (ii) to determine which CSP can satisfy these requirements. We present a framework to address these challenges. For challenge (i), our framework automatically detects conflicts resulting from inconsistent customer requirements. Moreover, our framework provides an explanation for the detected conflicts allowing customers to resolve these conflicts. To tackle challenge (ii), our framework assesses the security level provided by various CSPs and ranks the CSPs according to the desired customer requirements. We demonstrate the framework's effectiveness with real-world CSP case studies derived from the Cloud Security Alliance's Security, Trust and Assurance Registry.
| Typ des Eintrags: | Konferenzveröffentlichung |
|---|---|
| Erschienen: | 2016 |
| Autor(en): | Taha, Ahmed ; Metzler, Patrick ; Trapero, Ruben ; Luna, Jesus ; Suri, Neeraj |
| Art des Eintrags: | Bibliographie |
| Titel: | Identifying and Utilizing Dependencies Across Cloud Security Services |
| Sprache: | Deutsch |
| Publikationsjahr: | Mai 2016 |
| Verlag: | ACM |
| (Heft-)Nummer: | 11 |
| Buchtitel: | ASIA CCS '16 Proceedings of the 11th ACM on Asia Conference on Computer and Communications Security |
| Veranstaltungsort: | Xi'an, China |
| DOI: | 10.1145/2897845.2897911 |
| Kurzbeschreibung (Abstract): | Security concerns are often mentioned amongst the reasons why organizations hesitate to adopt Cloud computing. Given that multiple Cloud Service Providers (CSPs) offer similar security services (e.g., "encryption key management") albeit with different capabilities and prices, the customers need to comparatively assess the offered security services in order to select the best CSP matching their security requirements. However, the presence of both explicit and implicit dependencies across security related services add further challenges for Cloud customers to (i) specify their security requirements taking service dependencies into consideration and (ii) to determine which CSP can satisfy these requirements. We present a framework to address these challenges. For challenge (i), our framework automatically detects conflicts resulting from inconsistent customer requirements. Moreover, our framework provides an explanation for the detected conflicts allowing customers to resolve these conflicts. To tackle challenge (ii), our framework assesses the security level provided by various CSPs and ranks the CSPs according to the desired customer requirements. We demonstrate the framework's effectiveness with real-world CSP case studies derived from the Cloud Security Alliance's Security, Trust and Assurance Registry. |
| Freie Schlagworte: | Cloud security, security quantification, security service level agreements, service dependencies |
| ID-Nummer: | TUD-CS-2016-14769 |
| Fachbereich(e)/-gebiet(e): | Profilbereiche > Cybersicherheit (CYSEC) Profilbereiche |
| Hinterlegungsdatum: | 14 Aug 2017 11:54 |
| Letzte Änderung: | 15 Mai 2018 10:33 |
| PPN: | |
| Export: | |
| Suche nach Titel in: | TUfind oder in Google |
 |
Frage zum Eintrag |
Optionen (nur für Redakteure)
 |
Redaktionelle Details anzeigen |
Drucken
Impressum